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Executive  Summary 


Title:  Cyber  Warfare;  An  Evolution  in  Warfare  not  Just  War  Theory 
Author:  Lieutenant  Commander  Joel  Yates,  United  States  Navy 

Thesis:  While  some  argue  that  Just  War  Theory  is  irrelevant  to  eyber  warfare,  a  eareful  analysis 
demonstrates  that  it  is  a  useful  tool  for  eonsidering  the  morality  of  CW. 

Discussion:  Though  nations  have  a  right  to  self-defense,  there  are  eonstraints  and  limitations  to 
the  aetions  that  ean  be  taken  in  that  effort.  New  warfare  areas  throughout  the  history  of  war, 
whether  nuelear  warfare  or  air  warfare,  underwent  debates  of  whether  their  use  was  ethieal;  CW 
is  no  different.  With  a  eyberspaee  that  knows  no  physieal  boundaries,  it  is  important  to 
understand  the  ethieal  implieations  of  CW  that  includes  touching,  disabling,  degrading,  denying 
the  use  of,  or  destroying  distant  computing  systems  in  the  interest  of  protecting  national  security. 
There  are  many  facets  to  understanding  the  ethical  implication  of  such  operations.  Most  of  those 
facets  are  being  debated  under  the  question  of  whether  JWT,  in  its  original  form,  suffices  as  an 
accurate  ethical  measurement  for  cyber  operations.  This  paper  analyzes  the  two  camps  and 
provides  evidence  to  the  reasons  why  JWT  applies  to  CW. 

Conclusion:  As  long  as  the  U.S.  applies  the  JWT  criterion  when  confronted  with  a  decision  to 
respond  to  the  threat  or  use  of  force  by  an  antagonist,  the  weapon  it  choices  to  deploy  is 
secondary  to  the  justification. 
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Preface 

This  Master  of  Military  Science  (MMS)  paper  is  an  analysis  of  the  application  of  Just  War 
Theory  to  Cyber  Warfare.  As  government  and  civilian  organizations  continue  to  increase  their 
dependency  on  networked  computers  that  control  communications,  infrastructures,  and  weapons 
systems,  the  vulnerabilities  of  exploitation,  manipulation,  and  corruption  likewise  increase.  The 
threat  to  national  security  presented  by  these  vulnerabilities  challenges  nation-states  to  determine 
whether  Just  War  Theory  is  applicable  to  Cyber  Warfare. 

As  a  Navy  Information  Warfare  Officer  with  a  working  knowledge  of  Cyber  Warfare 
within  the  Navy,  an  exploration  of  the  Just  War  Theory  debate  seemed  a  worthwhile 
undertaking,  particularly  when  the  U.S.  Government  is  positioned  to  conduct  cyber  operations  in 
defense  of  the  national  security.  While  I  may  understand  the  operations  in  cyber  to  some  degree 
and  have  experience  in  Cyber  Warfare,  I  have  no  experience  in  international  law  or  Just  War 
Theory  outside  of  my  limited  understanding  obtained  through  the  research  of  this  paper  and 
course  work  at  the  United  States  Marine  Corps  Command  and  Staff  College.  I  have  however, 
received  a  considerable  amount  of  support,  assistance,  and  guidance  from:  Dr.  Francis  H.  Mario, 
PhD  in  Political  Science,  Associate  Professor  of  National  Security  Affairs,  U.S.  Marine  Corps 
Command  and  Staff  College;  Dr.  Rebecca  J.  Johnson,  PhD  in  International  Relations,  Associate 
Professor  of  National  Security  Affairs,  U.S.  Marine  Corps  Command  and  Staff  College;  Mr. 
Steve  Hendricks,  Senior  Intelligence  Officer,  Naval  Air  Systems  Command,  and  Professor  of 
Technical  Management  in  the  Master's  in  Systems  Engineering  and  Technical  Management 
program  at  Whiting  School  of  Engineering,  Johns  Hopkins  University.  I  owe  these  mentors  a 
huge  debt  of  gratitude  for  their  support,  guidance,  and  honest  feedback  during  this  period  of 
educational  growth.  More  importantly,  I  am  thankful  for  the  patience  and  motivation  my  spouse 
so  graciously  provided  me. 
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Chapter  One 
INTRODUCTION 


The  Internet  created  an  exponential  change  to  the  speed  of  communications  and  enabled  near 
instantaneous  sharing  of  information  across  the  globe.  In  many  cases,  this  change  greatly 
improved  global  business  interactions  and  military  operations,  and  allowed  people  to  interact 
socially  regardless  of  their  location.  As  the  Internet  use  continues  to  grow,  nation-states  are 
becoming  more  dependent  on  access  to  it  for  military  operations,  management  and  operation  of 
critical  infrastmcture,  and  business  interactions.  However,  along  with  these  enormous  benefits, 
the  Internet  has  also  created  an  avenue  for  individuals  (hacktivists*),  organizations  (such  as 
terrorist  or  criminal  groups),  businesses,  and  nation-states  to  conduct  harmful  cyber  warfare 
(CW).  While  some  argue  that  Just  War  Theory  (JWT)  is  irrelevant  to  CW,  a  careful  analysis 
demonstrates  that  it  is  a  useful  tool  for  considering  the  morality  of  CW. 

Anyone  connected  to  the  Internet  can  conduct  CW  against  governments  or  civilians  because 
of  the  wide  availability  of  simple  hacking  toolkits.  Though  individuals  with  simple  hacking 
tools  or  elementary  knowledge  of  computers  can  pose  threats,  they  are  typically  not  threats  that 
would  rise  to  the  level  of  national  security  concerns.  The  more  sophisticated  cyber  attacks  that 
are  most  threatening  to  nation-states  require  significant  financial  backing,  organization,  and 
intellectual  capital.  These  sophisticated  attacks  are  normally  committed  by  nation-states  or  well- 
organized  non-state  actors. 

To  give  some  perspective  on  the  above  threats  on  the  Internet,  the  following  two  actual  cyber 
attacks  illustrate  the  difference  between  a  less  advanced  and  more  sophisticated  cyber  attack. 

1.  A  15-year  old  Austrian  boy  hacked  259  websites  between  January  and  March  2012. 

His  hacking  skills  and  knowledge  were  nominal  at  best  prior  to  him  pulling  down  a 

* 

A  person  who  engages  in  hacktivism,  whieh  is  the  aet  of  haeking  into  a  Web  site  or  eomputer  system  in  order  to 
eommunieate  a  politieally  or  soeially  motivated  message. 
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prepackaged  set  of  hacking  tools  from  the  Internet.  His  hacking  ignorance  led  to  him  leaving 
his  Internet  Protocol  (IP)  signature  in  the  tools  when  he  launched  his  attack  on  the  web  sites. 
Police  detected  the  IP  error  and  prosecuted  the  boy. '  The  level  of  damage  he  caused  was 
relatively  minor  and  probably  amounted  to  lost  revenues  and  customer  trust  by  the  businesses 
that  were  hacked.  His  success  was  the  result  of  the  relative  ease  of  access  to  online  hacking 
tools  and  the  ease  in  exploiting  holes  in  the  servers  hosting  the  web  sites.  The  success  of  the 
attack  had  nothing  to  do  with  the  intellectual  capital,  financial  backing,  or  organization  of  his 
attack,  and  it  posed  little  threat  to  any  country's  national  security. 

2.  In  late  2009,  and  again  in  mid  2011,  Google  was  the  victim  of  sophisticated  cyber 
attacks  that  succeeded  in  defeating  its  elaborate  system  security  protocols.  The  attackers 
gained  access  to  source  code  and  Gmail  user  accounts  of  senior  U.S.  officials  and  human 
rights  activists.  Although  Google  suspected  China  for  the  attacks,  Google  officials  are 
careful  not  to  attribute  the  attack  directly  to  China.  Nevertheless,  the  level  of  sophistication 
involved  in  the  attack  required  intellectual  capital,  persistence  on  gathering  intelligence  of 
Google's  vulnerabilities,  and  financial  support.  Though  this  attack  was  not  necessarily  a 
threat  to  national  security,  if  a  similarly  capable  entity  (nation-state  or  otherwise)  targeted  a 
critical  network  that  supported  another  nation-state's  power,  water,  financial  markets,  or 
military  operations  with  the  same  level  of  sophistication  and  found  success,  it  could  create  a 
national  security  emergency. 

Both  of  the  examples  could  pose  potential  national  security  threats  to  governments  that  are 
increasingly  dependent  on  networked  military,  financial,  and  infrastructure  operations.  Though 
the  first  scenario  presented  little  threat  based  on  the  goals  and  intent  of  the  young  15 -year  old 
boy,  if  he  intended  to  target  government  websites  or  other  IP-supported  organized  services,  and 
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those  sites  were  similarly  vulnerable,  the  impaet  of  denying  the  serviees  provided  by  those  web 
sites  may  be  extremely  damaging  to  national  seeurity. 

The  inereased  government  employment  of  IP-networked  systems  throughout  the  globe  has 
sparked  a  debate  on  how  to  manage  and  eontrol  aetivity  on  the  Internet  in  the  interest  of 
minimizing  the  risks  to  the  eritieal  infrastruetures,  finaneial  markets,  and  military  operations.  In 
parallel  to  debates  on  international  poliey  and  aeeeptable  norms  of  Internet  eonduet,  a  debate  is 
ongoing  as  to  whether  it  is  ever  ethieal  for  a  nation  to  use  eyber  attaeks  against  another  nation. 
Whether  norms  and  follow-on  polieies  are  ever  established,  nations  must  take  measures  to 
defend  their  people,  finaneial  well-being,  and  military  eapabilities. 

Although  nations  have  a  right  to  self-defense,  there  are  eonstraints  and  limitations  to  the 
aetions  they  ean  take  in  that  effort.  New  warfare  areas  throughout  the  history  of  war,  whether 
nuelear  warfare  or  air  warfare,  underwent  serutiny  on  the  eonstraints  and  limitations  of  their 
ethieal  use;  Cyber  Warfare  is  no  different.  Conventional  weapons  systems  are  more  aeeurate, 
wirelessly  eontrolled  through  IP  eonneetions,  and  proeess  more  information  than  ever  before, 
whieh  makes  them  inherently  vulnerable  to  CW.  Civilian  eritieal  infrastrueture,  banking,  and 
medieal  systems  are  equally  vulnerable  when  eontrolled  and  managed  through  Internet  IP 
sehema.  With  that  in  mind,  there  are  ethieal  eoneems  with  CW  that  targets  weapons  systems, 
eivilian  eritieal  infrastrueture,  and  other  IP-eontrolled  systems. 

There  are  many  faeets  to  understanding  the  ethieal  implieation  of  sueh  operations.  With  a 
eyberspaee  that  knows  no  physieal  boundaries,  it  is  important  to  understand  these  faeets  of  CW 
that  ineludes  touehing,  disabling,  disrupting,  degrading,  denying  the  use  of,  or  destroying  distant 
eomputing  systems  in  the  interest  of  proteeting  national  seeurity.  Most  of  those  faeets  are  argued 
under  the  question  of  whether  JWT,  in  its  original  form,  suffiees  as  an  aeeurate  ethieal 
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measurement  for  cyber  operations. 

Two  of  the  major  bodies  of  JWT  are  jus  ad  bellum  and  jus  in  bello.  The  jus  ad  bellum  body 
addresses  the  morality  of  war  and  is  the  concept  that  the  initiation  of  war  must  be  within  a  just 
cause,  right  authority,  last  resort,  probability  of  success,  proportionality,  and  with  the  aim  of 
peace.  Nations  may  be  justified  in  initiating  war  within  one  of  two  situations.  First,  a  nation  has 
the  right  to  self-defense  in  response  to  a  use  of  force  against  it.  Secondly,  if  a  nation  interprets 
another  nation's  rhetoric  and  actions  as  a  threat  to  use  force  against  it,  it  may  be  justified  in 
launching  a  preemptive  strike  in  order  to  deter  or  eliminate  the  threat  from  the  opposing  nation. 

The  second  body  of  JWT  is  jus  in  bello.  It  deals  with  the  morality  in  war  between  nations. 
Once  the  nations  are  actively  at  war,  there  are  parameters  of  ethically  conducting  the  war  and 
using  force.  The  employment  of  force  must  be  directly  related  to  providing  a  military  advantage 
in  the  war  and  not  just  destroying  whatever  is  in  the  path  of  the  advance  indiscriminately.  It 
provides  a  means  to  measure  the  morality  of  the  employment  of  force  within  the  war,  whereby 
that  employment  can  be  judged  for  its  application  to  affect  the  opponent’s  ability  to  continue  the 
fight. 

The  JWT  application  to  CW  is  being  debated  over  the  jus  ad  bellum  and  jus  in  bello  bodies. 
This  paper  will  focus  on  the  first  aforementioned  situation  in  jus  ad  bellum  and  the  jus  in  bello 
bodies  to  understand  the  two  competing  arguments.  Moreover,  this  paper  will  use  the  JWT 
criterion  of  just  cause,  probability  of  success,  and  proportionality. 

Prior  to  discussing  the  arguments  on  both  sides  of  the  ethical  debate,  it  is  important  to 
understand  what  cyberspace  is  and  what  the  international  and  U.S.  government  positions  are  on 
CW.  The  U.S.  Joint  Publication  1  (Doctrine  for  the  Armed  Forces  of  the  United  States)  defines 
cyberspace  as  “a  global  domain  within  the  information  environment  consisting  of  the 
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interdependent  network  of  information  technology  infrastructures,  including  the  Internet, 
telecommunications  networks,  computer  systems,  and  embedded  processors  and  controllers." 
This  paper  will  use  this  definition,  beeause  it  encompasses  the  physical  and  informational  nature 
of  cyber.  Cyberspace  is  not  simply  a  virtual  “cloud”  of  information  transmitted  through  binary 
code  that  is  difficult  to  touch.  It  includes  the  physical  aspects  of  the  systems  that  interconnect 
through  the  IP  schema,  as  well  as  the  intangible  operating  systems  (OS),  software,  and 
information  held  within  the  hardware. 

The  physical  aspects,  OS,  software,  and  information  are  all  targets  for  exploitation, 
corruption,  and  manipulation.  The  nations,  groups,  or  individuals  that  take  advantage  of  these 
vulnerabilities  can  present  threats  to  peace,  breaches  of  peace,  and  acts  of  aggression,  as  the  15- 
year  old  Austrian  and  Google  incidents  demonstrate.  These  threats  and  breaches  of  peace,  and 
acts  of  aggression  require  evaluation  for  their  ethical  significance. 

The  U.S.  Government  is  posturing  itself  to  respond  to  any  threat  or  breach  of  peace,  or  act  of 
aggression.  In  the  May  2011  International  Strategy  for  Cyberspace,  President  Barrack  Obama 
stated,  "When  warranted,  we  will  respond  to  hostile  acts  in  cyberspace  as  we  would  to  any  other 
threat  to  our  country.  All  states  possess  an  inherent  right  to  self-defense,  and  we  reserve  the 
right  to  use  all  necessary  means — diplomatic,  informational,  military,  and  economic — to  defend 
our  Nation,  our  Allies,  our  partners,  and  our  interests.""^  With  this  statement,  the  U.S.  indirectly 
asserted  its  position  that  hostile  acts  in  cyberspace,  which  are  cyber  attacks,  are  "armed  attacks" 
and  positioned  itself  under  the  U.N.  Article  51^  umbrella  of  self-defense. 


^  Article  5 1 :  Nothing  in  the  present  Charter  shall  impair  the  inherent  right  of  individual  or  collective  self-defence  if 
an  armed  attack  occurs  against  a  Member  of  the  United  Nations,  until  the  Security  Council  has  taken  measures 
necessary  to  maintain  international  peace  and  security.  United  Nations,  Charter  of  the  United  Nations  and  Statute  of 
the  International  Court  of  Justice.  (New  York;  UN  Publications,  2013). 
http://www.un.org/en/documents/charter/chapter7.shtml. 
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Furthermore,  the  U.S.  Department  of  Defense  (DoD)  has  postured  itself  to  respond  to  ealls 
for  military  options  from  the  President.  In  June  2009,  DoD  direeted  the  establishment  of  the 
U.S.  Cyber  Command  (USCYBERCOM)  under  U.S.  Strategie  Command  (USSTRATCOM).  In 
Oetober  2010,  USCYBERCOM  reaehed  full  operational  status.  It  is  responsible  for 
synehronizing  and  eoordinating  Serviee  eomponents  within  eaeh  braneh  of  the  military, 
ineluding  U.S.  Army  Cyber  Command,  U.S.  Eleet  Cyber  Command/U.S.  TENTH  Eleet,  the  24th 
Air  Eoree,  U.S.  Marine  Corps  Eorees  Cyber  Command  and  U.S.  Coast  Guard  Cyber  Command.^ 
The  eommander  of  USCYBERCOM  is  also  the  direetor  of  the  National  Seeurity  Ageney.  That 
"dual-hatting"  provides  elose  eoordination  and  information  sharing  aeross  the  respeetive 
subordinate  units.  The  arrangement  ties  the  nation's  top  signals  intelligenee  (SIGINT) 
organization  with  the  nation's  eyber-foeused  military  eommand  in  a  symbiotie  relationship. 

The  reeent  efforts  by  the  U.S.  government  to  establish  a  distinet  military  eommand  strueture, 
strategy,  and  guidanee  toward  eyberspaee  and  operations  are  evidenee  that  it  thinks  the  potential 
for  eyber  eonfliets  is  high.  Indeed,  the  U.S.  has  already  aeknowledged  that  it  has  eondueted 
eyber  attaeks.  In  May  2012  then-Seeretary  of  State,  Hillary  Clinton  openly  admitted  that  the 
U.S.  eondueted  eyber  attaeks  against  A1  Qaeda  networks  in  Yemen. ^  This  eonfession  to  aetive 
eyber  operations  from  the  U.S.  is  proof  to  the  international  eommunity  that  the  U.S.  is  baeking 
up  the  new  eyber  organization,  strategy,  and  doetrine  with  aetions.  It  also  provided  the  evidenee 
that  the  U.S.  is  defending  itself  within  eyberspaee. 

Nonetheless,  the  question  of  JWT  applieability  remains  heavily  debated  within  the  U.S. 

The  manipulation  of  the  OS  and  software  through  vulnerabilities,  hidden  or  known,  ean  eause 
damage  to  eomputing  system's  physieal  eomponents  and  any  aneillary  equipment  or  systems. 
Additionally,  software  aeeessed  through  vulnerabilities  may  be  eontrolled,  reprogrammed,  or 
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made  ineffective.  This  physical,  OS,  and  software  manipulation  can  subsequently  affect  systems 
that  are  reliant  on  the  computer  to  operate.  Military  weapons  systems,  life-sustaining  hospital 
equipment,  city  power  grids,  water  treatment  plants,  and  traffic  control  mechanisms  that  are 
manipulated  by  cyber  weapons  can  cause  lethal  effects  to  human  beings.  There  are  several 
ethical  implications  to  targeting  civilian  systems,  and  the  assessment  of  those  ethical 
implications  are  why  ethical  reasoning  should  be  applied  to  cyber  operations. 

Military  and  civilian  academics  are  reviewing  JWT  because  its  application  to  CW  is  being 
questioned.  On  one  side  of  the  debate  are  scholars  such  Dr.  Patrick  Lin^,  Dr.  Fritz  Allhoff^,  and 
Dr.  Neil  Rowe.  The  three  argue  that  JWT  is  not  adequate  for  application  to  CW.  They  lean 
on  a  traditional  view  of  JWT  that  contends  that  the  JWT  only  applies  to  aggression  that  risks 

o 

human  life.  Their  assertions  depend  on  the  principle  that  cyber  weapons  are  only  weapons 
against  information  and  data,  but  are  not  a  part  of  warfare  that  injures  or  kills  human  beings. 

Another  critic  of  JWT’s  application  to  CW  is  Dr.  Randall  Dipert.^^  He  evaluated  the  JWT 
through  the  typical  six  criteria  of  jus  ad  bellum.  ^  His  argument  is  that  JWT  must  undergo  a 
makeover  to  be  applicable  to  CW.  He,  like  Lin,  Allhoff,  and  Rowe,  leans  on  the  premise  that 
cyber  weapons  are  not  capable  of  threatening  human  life  and  therefore  cannot  be  evaluated  for 
their  ethical  and  moral  use  under  the  JWT. 

The  counter  argument  is  that  JWT,  as  it  has  in  many  historical  cases  of  new  weaponry,  is 
capable  of  assessing  CW  without  undergoing  a  transformation.  Colonel  James  Cook^L  Dr. 


^Dr.  Lin  is  an  Associate  Professor  of  Philosophy,  and  Director  of  the  Ethics  and  Emerging  Sciences  Group  at 
California  Polytechnic  State  University. 

^  Dr.  Allhoff  is  an  Associate  Professor  of  in  the  Department  of  Philosophy  at  Western  Michigan  University,  and  a 
Senior  Research  Fellow  at  The  Australian  National  University’s  Centre  for  Applied  Philosophy  and  Public  Ethics. 

Dr.  Rowe  is  a  Professor  of  Computer  Science  at  the  Naval  Postgraduate  School. 

'  Dr.  Dipert  is  a  professor  at  the  State  University  of  New  York,  Buffalo. 

Colonel  Cook  is  a  Professor  at  the  U.S.  Air  Force  Academy. 
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Roger  Crisp^^,  and  Captain  (Retired)  Maxie  Davis***  argue  that  CW  ean  be  lethal.  The  three 
dispute  the  theory  that  the  six  eategories  of  JWT  are  not  useful  in  measuring  CW  aetions  to 
determine  their  ethieal  and  just  use. 

The  foeus  of  this  paper  is  to  analyze  both  arguments.  In  the  end,  this  paper  will  attempt  to 
show  that  eyberspaee  is  a  medium  eapable  of  launehing  eyber  weapons  that  eause  lethal  effeets 
on  human  beings,  equipment,  and  virtual  data.  Upon  establishing  that  argument,  the  applieation 
of  JWT  to  CW  should  be  evident. 


Dr.  Crisp  is  a  Professor  at  St.  Anne’s  College  of  Oxford 

Captain  (Retired)  Davis  is  the  Deputy  Information  and  Technology  Services  for  the  Department  of  Navy  and 
retired  US  Navy  Captain. 
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Chapter  Two 

EXAMINATION  OF  COMPETING  ARGUMENTS 

To  begin  this  examination,  it  is  important  to  put  into  perspective  the  number  of  reported 
cyber  attacks  occurring  annually.  The  breakdown  of  cyber  attacks  for  2012  is  shown  in  Figure  1, 
which  illustrates  the  small  percentage  of  attacks  that  would  break  the  threshold  of  threats  to 
national  security.  It  is  important  to  understand  that  this  chart  only  reflects  reported  cyber 
attacks  -  there  are  certainly  more  that  go  unreported. 


Attack  Distribution 


Figure  1 

As  the  chart  depicts,  the  majority  of  cyber  attacks  are  pure  Cyber  Crimes  and  Flacktivism. 

Far  less  of  the  cyber  attacks  are  Cyber  Espionage  and  Cyber  Warfare.  Though  Cyber  Espionage 
and  Cyber  Warfare  are  a  small  number  of  the  overall  cyber  attacks,  they  represent  the  largest 
threats  to  national  security  because  of  their  potential  to  target  military  operations,  critical 
infrastructure,  medical  services,  financial  institutions,  and  mass  transit  systems. 

CW’s  potential  to  inflict  harm  to  a  level  that  would  justify  a  responding  attack  with  a  cyber 
or  conventional  weapon  is  at  the  center  of  the  debate.  The  arguments  on  both  sides  are  focus  on 
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three  primary  areas:  just  eause,  probability  of  sueeess,  and  proportionality.  This  ehapter  will 
breakdown  the  differenees  within  the  debates  based  on  these  three  eategories. 


JUST  CAUSE 

Just  eause  in  JWT  is  the  premise  that  a  state  or  nation  ean  use  foree  when  it  is  in  “self- 
defenee  from  external  attaek;  the  proteetion  of  innoeents;  and  punishment  for  wrongdoing.” It 
does  not  mean  that  in  the  absenee  of  eredible  hostile  threats  or  aggression  that  a  state  ean  be 
justified  in  using  preemptive,  preventative,  or  responding  strikes  against  another  nation.  For  a 
response  to  threats  or  the  use  of  foree  to  be  within  the  just  eause  eriterion,  the  nation  targeted  by 
the  aggression  must  be  eredibly  threatened  or  wronged  by  the  aggressor  nation.  In  other  words, 
if  a  state  resorted  to  war  in  response  to  aggression  from  another  state  in  order  to  proteet  itself  and 
its  eitizens  from  attaek  or  to  right  the  wrong  from  a  previous  aggression,  the  responding  state 
would  satisfy  the  just  eause  body  of  JWT. 

Argument  against  CW  ereating  a  “just  eause” 

The  ease  that  Dipert,  Lin,  Allhoff,  and  Rowe  make  against  the  applieation  of  JWT  to  CW  is 
based  partly  on  their  belief  that  eyberspaee,  and  by  extension  eyber  attaeks,  eannot  eause 
physieal  harm  or  death  to  humans.  In  faet,  Dipert  argues  that  “[eyberwarfare]  differ  from 
previous  forms  of  warfare  in  neither  injuring  nor  killing  human  beings,  nor  eausing  lasting 
physieal  damage  -  but  ean  nevertheless  eause  serious  harm  to  a  nation's  vital  interests."  Others 
argue  similarly  that,  “If  aggression  in  eyberspaee  is  not  tied  to  aetual  physieal  harm  or  threat  to 

1  T 

lives,  it  is  unelear  then  how  we  should  understand  it.” 

The  argument  made  by  this  eamp  is  that  a  “just  war”  is  one  waged  when  human  life  or 
massive  destruetion  is  threatened,  or  if  a  use  of  foree  has  already  eaused  loss  of  human  life  or 
massive  destruetion.  However,  they  eoneede  that  eyber  attaeks  ean  have  seeond  or  third  order 
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effects  that  could  cause  loss  of  life  or  massive  destruction,  but  that  CW  is  never  the  first  order 
effect  and  therefore  isn’t  a  directly  lethal  weapon.'"^  The  assertion  is  that  CW  cannot  cause  a  loss 
of  life  or  massive  destruction,  and  therefore  could  not  create  a  just  cause  for  war,  and  by 
inclusion,  is  not  covered  by  JWT. 

Rebuttal 

Justifying  war  or  acts  of  aggression  in  any  warfare  area  is  complex  and  ambiguous,  but  that 
doesn't  preclude  the  use  of  JWT  to  ensure  the  greater  intent  of  self-defense  is  met.  Cook  argues 
that  CW  is  not  dissimilar  to  other  types  of  warfare  throughout  history  in  that  they  all  possessed 
ambiguities  that  did  not  invalidate  JWT.  Additionally,  just  because  cyber  weapons  have  not 
been  used  to  cause  a  death  does  not  mean  that  they  are  incapable  of  doing  so.  In  fact,  Dipert, 
himself  presents  a  scenario  in  which  cyber  weapons  could  hypothetically  cause  death. 

Dipert  admits  there  are  "sophisticated  computerized  weapons  systems”  that  are  susceptible  to 
cyber  attack.'^  Using  his  example  of  the  U.S.  Navy's  Aegis  system,  which  is  an  anti-aircraft  and 
anti-missile  radar  system  and  linked  to  missile  systems  that  are  designed  to  defeat  aircraft  and 
missiles,  the  harm  to  human  beings  is  testable.  Hypothetically,  if  a  belligerent  nation  launched  a 
cyber  attack  to  exploit  vulnerabilities  in  the  computing  systems  of  Aegis,  the  belligerent  may  be 
able  to  cause  the  missile  system  to  fire  on  a  civilian  or  military  aircraft  and  hence  cause  a  loss  of 
life.  The  theory  and  argument  that  CW  does  not  injure  or  kill  human  beings  becomes 
exceptionally  weak  under  that  hypothetical  problem.  As  a  disclaimer,  this  author  does  not  know 
whether  Aegis  is  actually  vulnerable  to  cyber  attack.  The  point  is  not  to  confirm  or  deny  Dipert' s 
claims  that  it  is  vulnerable,  but  to  show  the  potential  lethality  for  harm  through  CW. 

Furthermore,  the  DoD  doesn't  agree  with  any  of  the  assessments  that  CW  is  incapable  of 
harming  human  beings  and  has  codified  cyberspace  as  a  military  force-on- force  operation  within 
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traditional  war: 


Traditional  war  typically  involves  small-scale  to  large-seale,  foree-on-force 
military  operations  in  whieh  adversaries  employ  a  variety  of  eonventional 
military  eapabilities  against  eaeh  other  in  the  air,  land,  maritime,  and  space 
physical  domains  and  the  information  environment  (which  includes 
cyberspace)/’ 

The  eodifieation  of  cyberspace  as  an  element  of  conventional  military  eapability  provides 
evidenee  that  the  U.S.  considers  cyberspaee,  and  by  assoeiation  CW,  a  battleground  with  the 
potential  for  lethal  consequenees.  Ergo,  CW  threatened  or  used  against  the  U.S.  would  constitute 
a  “just  eause”  to  respond  and  thereby  the  application  of  JWT  to  CW  is  appropriate. 

PROBABILITY  OF  SUCCESS 

When  a  state  contemplates  resorting  to  war,  it  may  not  meet  the  probability  of  suceess 
measure  “[if]  it  can  foresee  that  doing  so  will  have  no  measureable  impaet  on  the  situation.”  In 
other  words,  “probability  of  suceess  is  always  a  matter  of  eireumstanee,  of  taking  reasonable 
options  within  the  eonstraints  and  opportunities  presented  by  the  world.”  The  probability  of 
success  eriterion  within  JWT  “[is]  to  bar  lethal  violenee  whieh  is  going  to  be  futile.”  Target 
discrimination,  developed  from  proper  attribution,  is  eritical  to  meeting  the  probability  of  suceess 
within  the  jus  ad  bellum  and  jus  in  bello  bodies  of  JWT.  Proper  attribution  provides  legitimate 
targets  that  serve  to  perpetuate  a  solution  to  the  eonfliet.  Therefore,  attacking  a  nation  without 
adequately  attributing  it  as  the  aggressor  of  attacks  (cyber  or  eonventional)  may  fail  the 
probability  of  suceess  eriterion  within  JWT  and  ereate  a  scenario  of  futile  lethality. 

Furthermore,  proper  attribution  diminishes  the  civil  liability  and  potential  for  international 
eondemnation  for  unjust  probability  of  suecess  determination.  All  that  diseussed,  ambiguities  in 
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attribution  are  rarely  decreased  to  zero  and  nations  may  decide  the  risk  of  not  acting  is  greater 
than  acting. 

Argument  that  originators  of  CW  may  not  be  identifiable 
The  camp  opposing  the  application  of  JWT  to  CW  highlights  the  problematic  task  of 
attributing  a  cyber  attack  to  its  originator.  Therefore,  without  proper  attribution  CW  fails  to  meet 
the  probability  of  success  within  JWT.  The  assertion  is  that,  "it  is  very  difficult  to  determine  the 
source  of  cyberattacks:  this  is  the  'attribution  problem'.”  Others  further  the  discussion  and 
explain,  "[the]  problem  with  cyberwarfare  is  that  it  is  very  easy  to  mask  the  identities  of 
combatants. It  is  in  fact,  very  difficult  to  attribute  cyber  attacks  and  therefore  attacking  a 
perceived  aggressor  incorrectly  would  lead  to  a  probability  of  success  issue. 

Any  nation,  group,  or  individual  Hactivist  that  targets  a  network  for  attack  can  conceal  their 
identity  from  the  victim  of  the  attack.  The  methods  of  concealment  are  many,  but  here  are  a  few 
to  help  understand  the  difficulty  in  tracing  attacks: 

1 .  Botnet  method  -  a  network  of  private  computers  infected  with  malicious  software  and 
controlled  as  a  group  without  the  owner's  knowledge,  e.g.,  to  send  spam.  It  can  be  used  to 

23 

launch  a  Distributive  Denial  of  Service  attack  (DDOS). 

2.  IP  spoofing  -  attacker  obtains  an  IP  address  of  a  legitimate  host  and  alters  packets  headers 
so  that  the  legitimate  host  appears  to  be  the  source  of  an  attack.  The  infected  host  can  be 
used  in  a  "zombie  army"  of  computers  to  launch  DDOS  or  malicious  code,  viruses,  and 

24 

worms. 

The  difficulty  in  tracking  the  origination  of  the  attack  can  also  be  further  complicated  by  the 
number  of  different  servers  that  help  route  internet  traffic  globally.  An  attack  may  traverse 
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several  eountry  borders  en  route  to  its  destination,  whieh  ean  eomplioate  the  traeking  based  on 
the  different  agreements  in  forensie  traeking  of  internet  ineidents. 

Some  people  suggest  establishing  international  agreements  to  require  digital  signatures  that 
would  make  traeking  attaeks  easier.  Their  argument  is  based  on  avoidanee  of  eollateral 
damage  to  eivilians.  Some  argue  to  fix  the  attribution  problem  it  may  require  a  'chip'  or 
universal  source  identification  be  inserted  in  every  computer.  In  their  argument,  the 
probability  of  success  in  targeting  the  correct  aggressor  would  be  much  greater. 

Rebuttal 

Attributing  the  sources  of  CW  threats  is  difficult  because  organizations  waging  CW  have  the 
talent  to  hide  their  identity.  The  attribution  problem  does  cause  difficulties  throughout  the  JWT 
criterion  and  the  probability  of  success  criteria  is  not  an  exception.  It  makes  it  that  much  more 
important  to  evaluate  all  the  indicators  that  could  provide  identification  clues,  which  could 
include  diplomatic  conditions,  intelligence  sources,  and  forensic  deconstruction  of  the  cyber 
device  used.  Actors  in  cyber  attacks  do  have  signature  ways  in  which  they  write  code  and  the 
forensics  intelligence  is  critical  in  cataloging  the  signatures  in  order  to  profile  the  attacks. 

Cook  compares  the  indistinctness  in  CW  to  identifying  the  Unabomber  -  eventually  the 
identity  is  developed  through  the  forensics  profiling.  In  his  words,  "we  can't  always  identify  the 
agents  of  violence  or  their  intentions."  Attribution  is  difficult  even  in  "cases  of  non- 
cyberattack,"  but  this  difficulty  doesn't  negate  the  usefulness  of  JWT. 

While  the  use  of  digital  signatures  to  track  cyber  attacks  and  help  avoid  false  targeting  of 
civilians  may  appear  attractive,  the  perception  of  it  being  a  "big  brother"  issue  and  the  fact  that 
not  all  nations  will  comply  with  the  regulations,  based  on  its  view  of  civil  liberties,  make  it 
unlikely  to  succeed.  Additionally,  much  like  restricting  the  ownership  of  assault  rifles  in  the 
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U.S.,  the  only  people  affected  are  the  ones  already  in  compliance  with  the  laws.  Those  who  have 
the  intent  to  do  covert  or  clandestine  harm  on  the  Internet  will  never  comply  with  digital 
signature  or  'chips,'  thus  making  attribution  just  as  difficult  as  before.  Furthermore,  the 
probability  of  success  measure  would  still  require  an  evaluation  of  whether  a  response  would 
help  in  culminating  the  aggression. 

Crisp  responds  to  the  digital  signature  argument  by  falling  back  on  the  historical  problem  of 
identifying  combatants  in  warfare,  such  as  British  service  personnel  living  amongst  the  French  in 
an  undercover  role  during  the  Second  World  War.  He  states  that  the  British  put  the  local  French 
citizens  in  harm’s  way  and  at  risk  of  being  mistaken  for  the  British  service  personnel.  Perhaps 
a  better  and  more  recent  situation  is  more  helpful  to  understand  the  point  of  attribution  - 
insurgency  in  Iraq. 

During  the  war  against  Iraq,  the  insurgent  groups  intermingled  with  the  local  population  and 
met  in  mosques  and  places  of  worship  to  conduct  meetings  that  planned  attacks  against  coalition 
forces.  These  situations  created  an  extremely  difficult  situation  for  the  coalition  forces  to  discern 
between  the  innocent  local  civilians  and  the  insurgents.  When  attacks  did  happen  from  a  crowd 
of  civilians  or  from  a  mosque,  origination  of  the  attack  was  difficult  to  determine,  but  through 
all-source  intelligence  and  pattern  of  life  investigations,  the  coalition  forces  became  effective  in 
identifying  the  sources  of  attacks  and  countering  those  attacks. 

In  investigating  cyber  attacks,  it  is  unquestionable  that  the  originator's  identity  can  be  elusive. 
However,  much  like  the  September  1 1th,  2001  attacks,  identification  of  the  perpetrators,  no 
matter  how  elusive  or  time-intensive  it  might  be  to  identify  them,  must  happen  so  that  further 
threats  to  national  security  are  mitigated.  The  investigation  to  identify  the  9/11  perpetrators  and 
the  insurgents  attacking  from  Iraqi  mosques  took  time  and  a  lot  of  work.  Nevertheless,  it  was 
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done  despite  the  novelty  of  using  eommereial  aireraft  as  weapons  or  using  loeal  Iraqis  to  mask 
the  identity  of  those  launehing  an  attaek.  JWT  and  the  eriteria  of  probability  of  sueeess  are  not 
negated  by  the  novelty  of  the  weapon  used. 


PROPORTIONALITY 

Proportionality  is  important  to  understand  prior  to  a  state  or  nation  initiating  a  war  beeause  it 
must  “[weigh]  the  universal  goods  expeeted  to  result  from  it,  sueh  as  seeuring  the  just  eause, 
against  the  universal  evils  expeeted  to  result,  notably  easualties.”  Proportionality  in  JWT  does 
not  mean  that  responses  must  fit  the  'an  eye  for  an  eye'  type  of  response.  The  response  from  a 
vietimized  state  may  be  more  damaging  than  the  initial  attaek,  if  it  meets  the  previous  eriteria  of 
the  universal  good  outweighing  the  universal  evils.  In  that  respeet,  the  response  may  cause  more 
damage  than  the  initial  aggression,  but  if  the  response  perpetuates  a  peaceful  end  to  the 
aggression  then  the  response  could  be  said  to  be  proportional.  In  this  way,  one  could  see  the 
benefits  of  attribution  within  proportionality. 

-  Argument  that  cyber  attacks  never  justify  conventional  weapons  response 

Lin  and  others  provide  an  explanation  of  proportionality  that  isn't  consistent  with  the  above 
standard  definition.  They  view  proportionality  as  "the  idea  that  it  would  be  wrong  to  cause  more 
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harm  in  defending  against  an  attack  than  the  harm  of  the  attack  in  the  first  place."  Their 
reasoning  is  that  there  is  no  situation  that  would  justify  a  conventional  response  to  a  cyber  attack, 
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because  a  conventional  weapon  would  cause  more  damage  than  the  cyber  attack  caused. 

The  argument  is  that  in  order  to  assess  the  proportionality  of  an  attack,  one  must  assess  to 
what  extent  it  was  successful  in  hitting  its  target,  and  what  damage  the  attack  caused  on  the 
intended  target  and  unintended  targets  (collaterally).  Some  use  the  Stuxnet  attack  on  the  Iranian 
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nuclear  centrifuge  process  in  an  attempt  to  illuminate  the  issue.  They  use  the  computer  worm 
as  an  example  of  cyber  attacks  that  spread  and  infect  other  more  than  just  the  intended  target, 
with  little  damage  to  the  actual  target.  The  Stuxnet  worm  targeted  the  Iranian  Natanz  uranium 
enrichment  plant,  which  is  known  to  be  a  closed  circuit  (or  'air  gapped')  network  that  could  only 
be  updated  by  the  German  Siemens’  engineers.  The  updates  were  purportedly  done  via 
after  the  engineers  connected  to  the  Internet  at  their  hotel  with  laptop  computers. 

The  USBs  were  tainted  with  the  Stuxnet  worm  and  transferred  the  worm  to  the  network  at  the 
Natanz  plant,  thereby  jumping  the  air  gap.  Estimates  credit  Stuxnet  with  successfully  damaging 
1000  centrifuges.  Unfortunately,  whoever  released  the  worm  caused  unintended  infections 
throughout  the  world,  which  may  have  caused  more  harm  than  was  caused  to  the  Iranian  nuclear 
program.  Researchers  found  that  "Stuxnet  had  a  foothold  on  more  than  100,000  computers,  and 
they  had  no  real  idea  what  it  was  doing  to  them."^"^  The  originators  of  the  destructive  worm 
didn't  know  the  extent  of  the  damage  done  to  the  target  until  Stuxnet  was  released  to  unintended 
computers.  The  aftermath  of  the  attack  proved  that  Stuxnet  hit  its  target  system,  but  that  it  also 
caused  unintended  collateral  damage  without  compelling  Iran  to  end  its  nuclear  ambitions. 

The  difficulty  in  not  being  able  to  determine  the  damage  caused  by  a  cyber  attack  limits  the 
ability  to  respond  with  proportionality,  and  therefore  this  camp  argues  that  JWT  does  not  apply 
to  CW.  To  them,  cyber  attacks  leave  too  much  room  for  interpretation  since  a  victim  of  an  attack 
could  mistakenly  think  they  were  harmed  more  than  they  were  actually  harmed.  That  mistake 
could  provoke  a  disproportional  response,  and  thereby  presenting  ethical  difficulties  for  the 
victim.  This  is  also  why  Dipert  leans  back  to  attribution  while  weighing  the  proportionality 

***  Stuxnet  was  a  sophisticated  worm  that  was  believed  to  have  infected  PCs  and  damaged  centrifuges  at  the  Natanz 
uranium  enrichment  plant  in  central  Iran. 

Universal  Serial  Bus  (USB)  is  an  external  bus  standard  that  supports  data  transfer  rates  of  12  Mbps.  A  single 
USB  port  can  be  used  to  connect  up  to  127  peripheral  devices,  such  as  mice,  modems,  and  keyboards.  USB  also 
supports  Plug-and-Play  installation  and  hot  plugging. 
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concerns  by  stating,  "In  the  ease  of  a  eyberattaek,  the  problem  is  uncertainty  about  who  attaeked 
us."  In  order  to  meet  the  proportional  eriterion  of  JWT  the  eounterstrikes  must  be  aimed  at  the 
right  enemy  to  determine  if  the  universal  good  outweighs  the  universal  evil  of  the  response. 

-  Rebuttal 

Proportionality  within  CW  is  problematic  when  intelligenee  is  poor,  but  this  problem  is  not 
new  to  war.  As  Cook  points  out,  the  U.S.  wrongfully  bombed  the  Chinese  embassy  in  Belgrade 
during  the  air  eampaign  over  Kosovo  based  on  bad  intelligence.^^  More  reeently,  the  U.S. 
caused  civilian  casualties  within  Pakistan  when  it  falsely  identified  a  eompound  as  an  insurgent 
respite  area.  These  unfortunate  events  unquestionably  eaused  disproportionate  damage  due  to 
poor  identification  of  the  aggressor  foree,  whieh  eaused  innoeent  individuals  to  die  with  no  gain 
toward  ending  the  eonfliets.  Cyber  attaeks,  like  any  eonventional  attaek,  that  are  waged  based  on 
inadequate  intelligenee  may  produee  a  90  pereent  eonfidenee  in  the  target,  but  be  eompletely 
wrong  based  on  errors  in  the  information  and  subsequently  eause  damage  to  wrongfully  targeted 
systems  or  people. 

Even  when  the  intelligenee  is  aeeurate  and  the  evidenee  staeks  up  to  a  high  eonfidenee  level, 
the  damage  assessment  of  eyber  attaeks  eould  be  problematie,  whieh  subsequently  makes 
assessing  whether  the  attaeks  were  proportional  diffieult.  However,  when  physieal  effeets  are 
the  purpose  of  the  CW  attack,  the  battle  damage  assessments  (BDA)  are  not  dissimilar  to  those 
of  eonventional  weapons.  For  example  -  if  a  eyber  attaek  targets  a  missile  system  similar  to  the 
Aegis  seenario  above,  and  the  eontrol  panel  for  the  missile  system  is  being  eontrolled  by  the 
eyber  invader  who  fires  a  missile  and  hits  the  a  target  assigned  by  the  eyber  attaeker,  the  BDA  is 
known  and  thus  the  proportionality  ean  be  assessed.  As  with  the  Stuxnet  worm  BDA,  the 
proportionality  assessment  heavily  leans  on  the  all-souree  intelligenee  meehanisms  in  order  to 
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understand  the  damage  to  systems  or  information  from  the  manipulation  of  industrial  eontrol 
systems. 

In  responding  to  a  eyber  attaek,  it  is  equally  important  to  do  the  hard  work  and  use  the  all- 
souree  intelligenee  apparatus  to  determine  the  aggressor.  In  developing  the  identity  of  the 
originator  of  a  eyber  attaek,  the  vietim  must  weigh  the  risk  of  being  attaeked  again  with  an 
aeeeptable  level  of  eonfidenee  in  the  identity  of  the  aggressor.  Cook  uses  an  appropriate 
seenario  where  a  nation  destroys  another  nation’s  early-warning  radars  with  a  eyber  attaek, 
leaving  the  nation  blind  to  air  and  missile  attaeks.  The  threat  of  air  or  missile  attaek  from  the 
aggressor  nation  is  real  and  the  vietim  nation  eannot  afford  to  be  100  pereent  eonfident  in  the 
attaeker's  identity  before  eontemplating  a  response.  Nor  ean  the  vietim  nation  afford  to  wait  and 
see  if  the  aggressor  nation  launehes  missiles  or  aireraft  to  exploit  the  vietim  nation's  blindness  in 
that  early-warning  seetor.  In  this  ease,  it  eould  be  argued  that  the  self-defense  and  proteetion  of 
innoeent  people  may  warrant  a  eonventional  or  eyber  attaek  response  with  the  aim  of  eliminating 
the  air  and  missile  threats,  and  probably  outweighs  the  importanee  of  a  high  level  of  attribution 

TO 

eertainty  for  proportionality  that  ensure  the  ratio  to  universal  good  and  evil  is  aeeeptable. 

Cyber  attaeks  on  an  aggressor  nation  like  that  in  the  above  seenario  may  be  appropriate,  but 
may  also  unintentionally  spread  to  innoeent  parties  and  therefore  ereate  proportionality  eoneems. 
This  argument  is,  again,  nothing  new  to  JWT  and  warfare.  Crisp  responds  to  this  argument  by 
stating,  "it  has  often  been  the  ease  that  those  who  unleash  the  dogs  of  war  know  full  well  that 
onee  released  it  may  well  be  impossible  to  restrain  them,  and  those  who  have  been  harmed  find  it 
hard  to  work  out  exaetly  how  signifieant  the  harm  in  question  is  or  may  turn  out  to  be."  War  is 
unpredietable,  so  it  is  always  diffieult  to  judge  proportionality,  whether  the  weapon  of  ehoiee  is  a 
eonventional  or  eyber  weapon.  Proportionality  assessments,  applied  to  CW,  provide  a  measure 
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to  ensure  aets  of  aggression  in  eyber  are  not  waged  without  weighing  the  eost  of  launehing  a 
response  to  a  eyber  attaek  against  the  benefits  it  may  produee,  whieh  may  ultimately  be  a 
reinstatement  of  peaee. 
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Chapter  Three 
CONCLUSION 

Cyber  operations,  speeifieally  eyber  attaeks,  present  new  challenges  to  warfare,  such  as  the 
speed  and  global  delivery  of  lethal  or  non-lethal  cyber  weapons.  Cyber  attacks  occur  at  the 
speed  of  light  and  can  traverse  the  globe  within  milliseconds,  delivering  effects  with  some 
anonymity.  Determining  the  source  of  attacks,  managing  proportionality  of  responsive  weapons, 
and  assessing  the  lethality  of  a  cyber  weapon  are  challenging  the  applicability  of  JWT  to  CW. 

As  history  has  shown,  new  technologies  change  the  character  of  war,  and  it  is  undeniable  that 
cyber  weapons  technology  has  and  will  continue  to  do  so.  Nevertheless,  JWT  remains  applicable 
to  assessing  the  justification  for  resorting  to  war  and  the  conduct  within  war.  Policies  and 
regulations  on  Internet  norms  or  conduct  will  be  difficult  to  agree  on,  but  as  the  U.N  Charter 
expresses  "Nothing  in  the  present  Charter  shall  impair  the  inherent  right  of  individual  or 
collective  self-defense  if  an  armed  attack  occurs. 

That  right  to  self-defense  is  what  the  U.S.  is  relying  on  to  support  its  operations  in 
cyberspace.  President  Obama  has  established  the  vision  and  hierarchy  of  command  to  posture 
the  U.S.  military  to  defend  the  nation  in  cyber.  Whether  that  defense  is  through  active  or  passive 
cyber  operations  does  not  matter.  What  will  matter  is  justly  responding  to  cyber  attacks  with 
either  cyber  or  conventional  weapons,  and  that  is  exactly  why  JWT  must  be  applied  to  CW. 

Both  side  of  the  argument  to  the  application  of  JWT  are  worthy  of  reading  to  develop  one’s 
sense  of  the  difficulties  CW  presents  to  JWT.  The  most  prominent  issues  being  discussed  on 
both  sides  of  the  argument  are  whether  cyber  is  or  is  not  lethal,  whether  a  probability  of  success 
measure  can  or  can  not  be  attained  because  of  attribution  problems,  and  whether  proportionality 
can  or  can  not  be  assessed  with  the  attribution  and  lethality  issues. 
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This  paper  contends  that  lethality  is  unquestionable  due  to  the  military,  government,  and 
financial  world's  reliance  on  networked  computers  that  are  vulnerable  to  exploitation  and 
damage.  The  interconnection  and  susceptibility  to  exploitation,  manipulation,  and  remote 
control  from  hostile  actors  allow  weapon  systems  to  be  controlled  with  lethal  consequences  and 
critical  government  infrastructures  to  be  manipulated  with  a  result  of  causing  deadly  health 
hazards  to  humans.  Attributing  such  acts  of  hostilities  presents  challenges  across  the  JWT 
spectrum,  but  it  is  not  dissimilar  from  historical  examples  that  use  JWT  to  determine  the  morality 
and  ethical  reasons  for  war. 

The  problem  with  attribution  is  conceded  with  exception.  Attribution  is  difficult  whenever 
new  technologies  change  the  character  of  war.  As  a  mostly  covert  operation,  CW  is  intended  to 
go  undetected  until  its  intent  is  realized,  and  it  is  difficult  to  immediately  know  the  source  of  the 
attack.  Nevertheless,  one  must  investigate  by  using  all-source  indicators  and  by  conducting 
forensic  analysis  of  the  attack  in  order  to  assign  attribution.  Though  the  identity  of  an  attack  may 
take  extensive  time  to  answer  and  may  very  well  go  unanswered,  the  effort  must  be  made  so  that, 
if  a  response  is  necessary,  JWT  can  be  applied  to  ensure  just  cause,  probability  of  success,  and 
proportionality  are  considered. 

Colonel  Cook  is  correct  when  he  concludes  that  the  "potential  problems  in  the  application  of 
the  JWT  to  CW  represent  differences  in  degree  rather  than  in  kind.""^'  Cyberspace  is  the 
medium  in  which  cyber  weapons  are  deployed  under  the  umbrella  of  CW.  As  long  as  the  U.S. 
applies  the  JWT  criterion  when  confronted  with  a  decision  to  respond  to  the  threat  or  use  of  force 
by  an  antagonist,  the  weapon  it  chooses  to  deploy  is  secondary  to  the  justification.  After  a 
careful  review  of  the  arguments,  the  application  of  JWT  to  CW  is  absolutely  useful  to  evaluate 
the  morality  of  actions  within  cyberspace. 
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